Tuesday, May 9, 2023
2 changes · master
Security fixes and vulnerability patches
This change strengthens how Odoo validates search filter fields, especially for translated fields. It prevents malformed filters from producing unsafe database queries, reducing the risk of SQL injection and improving platform security.
Original PR description
Since https://github.com/odoo/odoo/commit/5a998694a6f353da05d7f69e4c59b9e7dd139e27, we don't crash anymore at https://github.com/odoo/odoo/commit/5a998694a6f353da05d7f69e4c59b9e7dd139e27#diff-fa4d9268d6e65e19aebec81c46038f0e496b91142588ed4d1c1bce7ff2338f2cL759 (at `field.auto_join`) if `len(path) > 1`, `field` is translated the `left` is not only a field name (example: `"name.<something else>"`). Because we trust `left` at this [point](https://github.com/odoo/odoo/blob/1bbdd77f0ee6bd632f5ade88b8b71c5576fa9053/odoo/osv/expression.py#L1339), (we shouldn't, coming from https://github.com/odoo/odoo/pull/101115) then SQL expression generated for translated field is unsafe (SQL injection). In case of translated field, check that `left` side is only a valid field name. (if it is not, it will crash later in `__leaf_to_sql`). In addition, use `field.name` instead of `left` when it is possible to be more robust.
Newly created bank accounts are no longer automatically trusted for outgoing payments unless the user has the proper permission. This helps reduce the risk of unauthorized payment details being enabled at creation time.
Original PR description
This comes as a followup of https://github.com/odoo/odoo/pull/120423 where we restrict unallowed users to toggle the field allow_out_payment when writing on res.partner.bank. Similarly, we'll now do the same check at the creation of bank accounts --- I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr